Audit Review of the Corporate Purchase Card Process

Internal Audit DepartmentNeighborWorks® America

Audit Review of the Corporate

Purchase Card Process

Project Number: FIN.PURCARD.2013

(b) (4)

1

Audit Review of the Corporate Purchase Card Process Table of Contents

Completion Letter .......................................................................................................................... 1

Function Responsibility and Internal Control Assessment .......................................................... 3

Executive Summary of Observations, Recommendations, and Management Responses ....... 4

Risk Rating Legend: ....................................................................................................................... 9

Background .................................................................................................................................. 10

Objective ....................................................................................................................................... 11

Scope ............................................................................................................................................ 11

Methodology ................................................................................................................................. 11

Observations and Recommendations ........................................................................................ 13

Conclusion .................................................................................................................................... 15

APPENDIX A – NeighborWorks America Purchase Card Policy ................................................. 16

Appendix B – Corporate Card Transaction Analysis .......................................................... 18

(b) (4)

(b) (4)

2

May 15, 2013

To: NeighborWorks America Audit Committee

Subject: Audit Review of the Corporate Purchase Card Process Please find enclosed the final audit report of the Corporate Purchase Card process. Please contact me with any questions you might have. Thank you.

Frederick Udochi Director of Internal Audit

Attachment cc: E. Fitzgerald M. Forster C. Wehrwein J. Bryson

Z. Shiferaw

(b) (4)

(b) (4)

3

Function Responsibility and Internal Control Assessment Audit Review of the Corporate Purchase Card Process

Business Function Responsibility

Report Date Period Covered

Finance

May 15, 2013

Purchase Card Transactions posted between October 1, 2011 - January 31, 2013

Assessment of Internal Control Structure

Effectiveness and Efficiency of Operations

Generally Effective1

Reliability of Financial Reporting

Generally Effective

Compliance with Applicable Laws and Regulations

Generally Effective

This report was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing.

1 Legend for Assessment of Internal Control Structure: 1. Generally Effective: The level and quality of the process is satisfactory. Some areas still need improvement. 2. Inadequate: Level and quality of the process is insufficient for the processes or functions examined, and require improvement in several areas. 3. Significant Weakness: Level and quality of internal controls for the processes and functions reviewed are very low. Significant internal control improvements need to be made.

(b) (4)

4

Executive Summary of Observations, Recommendations, and Management Responses

Summarized Observation; Risk Rating

Management Agreement

with Observation

(Yes/ No)

Internal Audit Recommendation

Summary

Accept IA Recommendation

(Yes/ No)

Management’s Response to IA

Recommendation

Estimated Date of

Implementation (Month/Year)

Internal Audit Comments

on Management

Response Observation No. 1 Single Purchase Limit Internal Control NeighborWorks America has established a single purchase card limit of

cardholder. Based on our review of the sample statements, Internal Audit noted eight instances (24% of the sampled statements) where the cardholder circumvented the single purchase limit control by dividing the invoice into multiple payments or by making multiple purchases of similar goods on the same date to the same vendor and the total of the payments exceeded Risk Rating:

Yes Recommendation No. 1 Revision to the Purchase Card Policy – Single Purchase Limits Internal Audit recommends a revision to the purchase card policy to specifically address single purchase limits. The revision should include the following:

A statement prohibiting actions to circumvent the control;

The alternative procedures that should be followed in the event that a purchase cardholder encounters a business purchase that will exceed the single purchase limit of

and; An outline of the

consequences for not following the policy and circumventing the

Yes Management agrees to increase the single purchase limit for several teams within the Training Division – the Registration, Production and Staff Development Units will be increased to

per single purchase given their business needs. All other business units will remain unchanged.

Management also initiated from US Bank an alert that will come to the Finance administrator for any transactions that eclipse the single limit

respectively. This

will proactively allow for immediate contact to the cardholder initiating a request for an explanation related to the invoice split.

October 1, 2013 Internal Audit accepts

Management’s response.

(b) (4)

(b) (4)

(b) (4)

(b) (4)

(b) (4)

(b) (4)

6



with Observation

(Yes/ No)


Summary


(Yes/ No)


Recommendation

Estimated Date of



on Management

Response Observation No. 2 – Corporate Code of Conduct - Complimentary Gifts Section 11 of the Corporate Code of Conduct governs the receipt of gifts from outside sources. Reliable is an office supply company used solely by one cardholder that consistently provides the cardholder with complimentary gifts for purchases made on behalf of NeighborWorks. The gifts consisted of luggage/bag sets and food. Based on our understanding of the iitems received, Internal Audit determined that the aggregate annual value exceeds $50. Per inquiry with Finance and the cardholder, Internal Audit notes the cardholder asserts that the gifts were made available/shared with

Yes Recommendation No. 2 – Complimentary Gifts and Vendor Management We recommend Finance revise the Purchase Card Policy to incorporate (or reference) section 11 of the Corporate Code of Conduct (the Code).

In addition, we also recommend that Management consider conducting a cost benefit analysis to evaluate whether the company could benefit from establishing business accounts with select vendors for office supplies and other frequently purchased goods. The establishment of business accounts would likely increase cost savings to NeighborWorks as a whole based on volume and reduce the risk that individual purchasers could benefit from NeighborWorks related purchasing activity.

Yes Management has already established a protocol with several national account vendors for volume aggregation and price discounting for specific goods and office supplies – this has been in place for several years. Administrative Services and Field Offices will work together with Finance to strengthen the utilization and compliance with the existing protocol. In several instances with vendors, management was unsuccessful in achieving a national account structure due to the relatively small scale of purchases placed with the vendor on an annual basis.

Management has moved to include the appropriate code of conduct sections into the Purchase Card Policy (with annotated cross reference) and will include specific references in the orientation process for new cardholders.



7



with Observation

(Yes/ No)


Summary


(Yes/ No)


Recommendation

Estimated Date of



on Management

Response office staff; however, no documentation was available to support the assertion.

Risk Rating:

Management will also take appropriate steps with the vendor identified (Reliable) to limit their complimentary gifts in the future.

(b) (4)

8



with Observation

(Yes/ No)


Summary


(Yes/ No)


Recommendation

Estimated Date of



on Management

Response Observation No. 3 Supporting Documentation – FedEx According to the Purchase Card Policy, all receipts should be provided to support charges made on the purchase card. Per review of the selected purchase card statements, Internal Audit notes that documentation was not consistently provided to support FedEx transactions included on 18 (55%) of the 33 statements reviewed (valued at $2,996).

Risk Rating:

Yes Recommendation No. 3 Supporting Documentation Requirements – Summary from FedEx Internal Audit recommends Management request cardholders to generate a report of shipping activity charged to the purchase card from the FedEx online Ship Manager Tool. The following information should be captured on the report:

Transaction origination (Sender Information)

Transaction Destination (Recipient Information)

Tracking Number Date Shipped

The streamlined reporting requirements should be communicated to all purchase cardholders to ensure the appropriate supporting documentation is provided for future FedEx purchase card transactions.

Yes Management agrees with the recommendation and Finance and Administrative Services will collaborate to set-up protocols and interfaces for efficiently getting a monthly statement as recommended by the Internal Audit team.



(b)

(b)

9

Risk Rating Legend: Risk Rating: HIGH A serious weakness which significantly impacts the Corporation from achieving its corporate objectives, financial results, statutory obligations or that may otherwise impair the Corporation’s reputation. Risk Rating: Moderate A control weakness which could potentially undermine the effectiveness of the existing system of internal controls and/or operational efficiency, integrity of reporting and should therefore be addressed. Risk Rating: Low A weakness identified which does not seriously detract from the system of internal control and or operational effectiveness/efficiency, integrity of reporting but which should nonetheless be addressed by management.

Management Response to Audit Review of the Corporate VISA Purchase Card Process

# Of Responses Response Recommendation #

3

Agreement with the recommendation(s)

1, 2, 3

0

Disagreement with the recommendation(s)

N/A

10

Background NeighborWorks America participates in the Government Services Administration’s (GSA) federal

purchase card program with via a contractual agreement with the Department of Veteran Affairs, which permits NeighborWorks to tag onto its existing agreement/task order. The purchase card program was established to streamline the purchasing process of frequently purchased low dollar value goods and services. The purchase card is issued to staff with the appropriate delegated purchasing authority and primary purchasing responsibilities within a unit. Requests for purchase cards are made by the Division Director directly to Finance. Upon receipt of the “Redelegation of Obligation and Disbursements Authority” memo signed by the employee and the Chief Executive Officer, the Accounts Payable (AP) Manager requests a new card from for the employee. All purchase cards are received by the Accounts Payable Manager and all cardholders are required to sign the Purchase Card Acknowledgement form prior to obtaining the card from the AP Manager. The corporate purchase card is used by the cardholders to purchase items such as office supplies, subscriptions, publications, printing, conference/training registration fees, tuition, shipping/postage, computer software, group meals, and other miscellaneous business transactions. The purchase card should not be used for staff/non-staff travel expenses and personal use is strictly prohibited. Finance has established a credit limit of for each cardholder and a single purchase limit of As of the date of this audit review there are a total of 40 active corporate purchase cardholders.

(b) (4)

(b) (4)

(b) (4)

(b) (4) (b) (4)

(b) (4)

(b) (4)

(b) (4)

(b) (4)(b) (4)

12

In addition, Internal Audit selected a sample of recent card issuances and reviewed documentation to support the proper documentation existed to support the issuance of a new purchase card.

13

Observations and Recommendations Observation No. 1 – Single Purchase Limit Internal Control NeighborWorks America has established a single purchase card limit of per cardholder; however, to accommodate business purchases that may exceed the single purchase card limit, cardholders are instructed to contact the AP Manager to request a temporary increase. Based on our review of the sample transactions, Internal Audit noted eight instances (24% of the sampled statements) where either the invoice was paid in multiple payments on the same date or multiple transactions (of similar goods) were made on the same date to the same vendor for business related items. The total payments exceeded through these split payments and undermine the single purchase limit internal control. We also observed that the purchase card policy (See Appendix A for a copy of the current purchase card policy) does not explicitly provide staff with guidance on proper procedures to follow when a purchase card transaction exceeds Recommendation No. 1 – Revision to the Purchase Card Policy – Single Purchase Limits Internal Audit recommends a revision to the purchase card policy to specifically address single purchase limits. The revision should include the following:

A statement articulating that splitting invoices and/or purchasing activity to circumvent the individual transaction purchase card limit is strictly prohibited;

The alternative procedures that should be followed in the event that a purchase cardholder encounters a business purchase that will exceed the single purchase limit of

The alternative procedures include – 1) contacting the AP Manager to request a temporary single purchase limit credit increase and 2) defining the timeframe for which a temporary credit increase with be active, and;

An outline the consequences for not following the policy by circumventing the single purchase limit control.

In addition to revising the purchase card policy, Internal Audit also recommends, Finance periodically analyze purchase card activity to assess whether due to the nature of the purchasing activity of specific cardholders an increase in their single purchase card limit may be necessary; however, the increase should not exceed the amount of less than

Observation No. 2 – Complimentary Gifts – Corporate Code of Conduct Section 11 of the Corporate Code of Conduct – Gifts from Outside Sources – states that an employee should not directly or indirectly solicit or accept a gift given the employee’s official position unless the aggregated market value of the individual gift was $20 or less per source per occasion provided that the aggregated market value of individual gifts received from any one person/entity shall not exceed $50 in a calendar year. The section also states that an employee shall not accept gifts from the same or different sources on a basis so frequent that a reasonable person would be led to believe the employee is using his/her official position for private gain. Based on the testing performed over five purchase card transactions made with

(b) (4)

(b) (4)

(b) (4)

(b) (4)

(b) (4)

14

the vendor – Reliable the vendor consistently provided the cardholder with complimentary gifts, which included luggage/bag sets and food with each order placed. Based on our understanding of the items received, Internal Audit determined that the aggregate annual value exceeds $50. Per inquiry with Finance and the cardholder, Internal Audit notes the cardholder asserts that the gifts were made available/shared with office staff; however, no documentation was available to support the assertion.

Recommendation No. 2 – Complimentary Gifts and Vendor Management We recommend Finance revise the Purchase Card Policy to incorporate (or reference) section 11 of the Corporate Code of Conduct (the Code) to increase assurance and awareness that purchase cardholders understand the Code’s applicability to the purchasing process.

In addition, we also recommend that Management consider conducting a cost benefit analysis to evaluate whether the company could benefit from establishing business accounts with preferred vendors for office supplies. The establishment of business accounts would likely increase cost savings to NeighborWorks as a whole based on volume and reduce the risk that individual purchasers could benefit from NeighborWorks related purchasing activity.

Observation No. 3 – Supporting Documentation for FedEx Charges According to the Purchase Card Policy, all receipts should be provided to support charges made on the purchase card. Per review of the selected purchase card statements, Internal Audit notes that documentation was not consistently provided to support FedEx transactions included on 18 (55%) of the 33 statements reviewed (valued at $2,996).

Per inquiry with the AP Manager, Internal Audit notes that because the individual amount for FedEx transactions is typically not significant, Finance does not require receipts or supporting documentation for any FedEx transactions. Internal Audit also notes that the individual FedEx charge amounts are not material; however, in the aggregate FedEx charges total $97,980 representing 7% of the total charges made to the purchase cards. Also, FedEx is the second highest of charges to an individual vendor.

Recommendation No. 3 – Supporting Documentation Requirements – Summary from FedEx Internal Audit recommends Management request cardholders to generate a report of shipping activity charged to the purchase card from FedEx online’s Ship Manager Tool. The following information should be captured on the report:

Transaction Origination (Sender Information) Transaction Destination (Recipient Information) Tracking Number Date Shipped

The streamlined reporting requirements should be communicated to all purchase cardholders to ensure the appropriate supporting documentation is provided for future FedEx purchase card transactions.

(b) (4)

(b) (4)

15

Conclusion The Corporate purchase card program provides for a more streamlined purchasing process to purchase low dollar amount goods and services throughout the company. The company has established controls to minimize its risk in relation to the purchase card program. The current Purchase Card Policy and other auxiliary company policies serve as a foundation to provide cardholders with the guidance needed to encourage proper use. Internal Audit notes that incorporating the recommendations noted within this report will further enhance the process to provide assurance that adequate controls are established and operating effectively to promote accountability and mitigate risk to the Corporation.

(b) (4)

16

APPENDIX A – NeighborWorks America Purchase Card Policy 911 Purchase Card Policy and Procedures A purchase card is a charge card designed for corporate procurement with the objective of streamlining the purchasing process. These cards will be used for high volume low dollar repetitive purchases of the company. The average purchase is usually less than $1,000 per transaction. They include office supplies, subscriptions, publications, printing, registration, membership, postage, equipment rental, photo supplies, classified ads, group meals, computer software and other miscellaneous charges. However, you may use it also to purchase expenses that exceed $1,000. In such an instance, a supervisor’s approval and purchase order should be prepared for expenses of $5000 or more prior to charging the expense to the credit card. Purchase card should not be use for travel related expenses such staff or non-staff airline tickets, hotel, etc. Personal use of the purchase card is strictly prohibited. The purchase card is issued to a staff with delegated authority and those who are responsible for the administrative purchases within the business unit. When the cardholder makes a purchase using the purchase card, the receipt from the vendor should be retain. Each month, a statement is sent to Finance that is forwarded to the cardholder. He or she will reconcile the statement to their receipts. The reconciled statement is then approved by the supervisor and sent to accounts payable for processing. The purchase card can be issued to a staff person with sufficient delegated authority with the supervisor‘s approval. Normally, we would like to issue the card to a staff person who is responsible for the administrative operation of the business unit. How to apply for Purchase Card E-mail or fax an approved memo from your supervisor to the accounts payable department. They will in turn fax or route the application to The normal processing time for the card is 10 days from the time the bank receives the application. Please note that the staff person should have sufficient delegated authority before applying for the card. Responsibilities of a Cardholder Comply with the current purchasing policy and delegation limitation when making purchases with the credit card. Review and certify all transactions in the monthly bank statement. Allocate the proper account and subaccount code to each transaction in the statement. Attach all receipts to the statement. For order made through the Internet or phone, attach the delivery ticket to the statement. Prepare a purchase order prior to ordering items that cost $5000 or more, even when the credit card may be used. Identify disputed transaction. Attempt to resolve service related disputes with the merchant directly. Notify of any unresolved disputed transaction within 60 days of receipt of invoice/statement by calling The dispute form can be downloading from the Intranet under the Finance site. Finance can suspend the purchase card if the account reconciliation is submitted 15 days after the Finance submission date. The purchase card will be cancelled if the reconciliation is 60 days past due the Finance submission date. If a purchase card is cancelled or suspended, no new cards will be issued to the members of the unit until the complete reconciliation from the previous cardholder is submitted. We will also need approval from the Chief Financial Officer or Controller to reinstate the card.

(b) (4)

(b) (4)

(b) (4)(b) (4)

17

Alternate Card User An alternate card user will be the only other authorized user of the card in absence of the cardholder due to vacation, sick or other type of leave of absence. All purchases that are done through the alternate user should be approved by the cardholder‘s supervisor. Credit limit The card has a monthly credit limit of and up to per transaction credit limit. Liability: Card lost or stolen The purchase card carries the same liability pattern as credit card - $50 maximum which can be waived if there is proof of fraudulent use. Payment Terms Purchase cards are non-revolving charge card. They need to be paid in full each month based on the Prompt Payment Act. Corporate rebates are offered based on volume and prompt payment. Approval Process In the interest of sound internal control, auditors insist that every purchase should involve at least two people. In an ideal situation, one person would approve the purchase, another would confirm the receipts of goods and a third person would approve the invoice for payment. The person approving the payment should not be a subordinate to the person who ordered the goods. Of course, it‘s not always convenient to have this segregation of duties in every case. The risk to internal control is greater with a purchase card with a maximum per transaction limit and a large credit line. Therefore, we wanted to issue the purchase card to the person with the most day-to-day responsibilities for office management, such as the District Service Manager (rather than the District Coordinator or other non-exempt employee) or Senior Administrative Assistants. Given this, the only other person who could approve the payment is the supervisor which in some cases is the District Director or the department manager. In the interest of good internal control, all cardholders should review the monthly statement and sign once to signify approval for payment. The purchase card will be cancelled once we received official notification regarding the termination of employment. The supervisor will be responsible for approving and reconciling all the statements that are forthcoming.

(b) (4)

(b) (4)

(b) (4) (b) (4)

(b) (4)

18

Appendix B – Corporate Card Transaction Analysis TABLE B1 - Purchase Card Activity Summary Analysis

Transaction Amount Range

No. of Transactions

% of Transactions

Transaction Amount

% of Amount

<100.00 10,216 79.91% $153,965.51 10.93% 100.00-499.99 1,839 14.39% $427,156.97 30.33%

500.00-999.99 405 3.17%

$280,838.94 19.94% 1,000.00-1,499.99 140 1.10% $167,318.31 11.88% 1,500.00-1,999.99 117 0.92% $201,814.14 14.33% 2,000.00-2,499.99 34 0.27% $76,059.27 5.40% 2,500.00-5,000.00 31 0.24% $87,916.35 6.24%

>5,000.00 2 0.02% $13,521.00 0.96% TOTALS 12,784 100.00% $1,408,590.49 100.00%

(b) (4)

21

Table B4 - Purchase Card Activity - Top 10 Merchant Category Codes (MCC)

Merchant Category Group Code*

Merchant Category Code (MCC)*

Transaction Amount

No. of Transactions

MRO SUPPLIES OTHER DIRECT MARKETER $141,828.18 435 WHOLESALE TRADE WHOLESALE OFFICE SUP $140,341.41 878 BUSINESS EXPENSE SCHOOLS/EDUCATIONAL SCHL $106,299.40 105 OTHER COURIER SERVICES-AIR/GROUND $97,980.42 7,680 EATING/DRINKING EATING PLACES AND RESTAURANTS 488,759.30 339 OFFICE SERVICES BUSINESS SERVICES -OTHER $85,383.66 198 BUSINESS EXPENSE COLLEGES,UNIVERSITIES $59,179.89 60 BUSINESS EXPENSE PROFESSIONAL SERVICES $39,280.44 130 OFFICE SERVICES PUBLISHING/PRINTING $39,165.01 49 BUSINESS EXPENSE CHARITABLE/SOCIAL SERVICE 436,494.15 88

Top 10 MCC TOTAL $834,711.86 9,962

Percentage of Total Purchase Card Transactions 59% 78%

Documents

Audit Review of the Corporate Purchase Card Process